authenticate() test for locked/disabled accounts regardless of password match

Locked or disabled accounts should always show the same error message regardless of whether the password is a match to avoid brute force/enumeration